See everything you missed at TailscaleUp.Read the recap →

Set up OpenAI

Last validated:

Configure an OpenAI provider in Aperture so your team can access GPT models through your tailnet. OpenAI is the default provider type in Aperture. When no compatibility block is specified, Aperture enables openai_chat automatically, but does not enable openai_responses unless you set it explicitly.

Your client and selected provider must support the same API format. Refer to Supported providers and clients for available setup options and requirements.

Prerequisites

Before you begin, you need:

Configure the provider

Add OpenAI as a provider in your Aperture configuration:

{
  "providers": {
    "openai": {
      "baseurl": "https://api.openai.com",
      "apikey": "<your-openai-key>",
      "models": ["gpt-5.5", "gpt-5.4-mini", "gpt-5.3-codex"],
      "name": "OpenAI",
      "compatibility": {
        "openai_chat": true,
        "openai_responses": true
      }
    }
  }
}

The openai_responses flag enables the Responses API, which tools like OpenAI Codex use. When you include a compatibility block, set both flags explicitly. Without a compatibility block, Aperture enables only openai_chat by default. Refer to the compatibility flags reference for the full list of flags.

By default, Aperture injects the configured apikey on every request to OpenAI. To instead forward each client's own credential to OpenAI, set auth_mode: "passthrough" on the provider. The client then supplies its own API key, which Aperture forwards to OpenAI unchanged. Refer to Set up passthrough mode for the full configuration.

Verify the provider

Administrators can test a connection to a specific model from the Models page of the Aperture admin dashboard.

  1. Open the Aperture admin dashboard at /admin/ and select Administration > Models.
  2. Find the model you want to test in the list of configured models. If the model is not listed, check your provider configuration and ensure the model name is correct.
  3. Select the Play icon to the left of the model name to send a test request. If the request succeeds, the icon changes to a green check mark. If it fails, the icon changes to a red "X".

Aperture sends a test request through the configured provider. This tests the gateway's provider configuration, not a separate client's credentials or another user's grants.

Next steps